feat(nostr): flag events whose NIP-52 publish didn't land

Inventory reaches clients only through the republished calendar event,
and until now a publish that failed or was skipped left no durable
trace — only a log line, if that. Twice the drift was caught by a human
reading a wrong number on a public page (#35 on aio-demo, #51 on cfaun,
where an event's relay copy sat 14 days behind the DB).

Adds `events.nostr_publish_pending`, set before every attempt and
cleared only on a confirmed success. Ordering it that way is what makes
"the attempt was never made" — no signer resolved, no NostrClient, the
process died mid-flight — as discoverable as "the attempt raised". Both
shapes have now been observed in production; only the second one was
ever visible.

`set_ticket_paid` raises the flag inside its own update so the counters
and "the relay doesn't know about them yet" commit atomically, and the
sale path pays no extra write.

`publish_or_delete_nostr_event` now returns a bool so callers can
branch. The flag, not the return value, is the durable record — the
existing call sites stay correct ignoring it.

Publish failures move from WARNING to ERROR: the published ticket count
has stopped tracking reality, which is not routine journal noise.

Refs #35

nostr_publisher.py

@@ -212,5 +212,8 @@ async def publish_event_to_nostr(
         return nostr_event
 
     except Exception as e:
-        logger.warning(f"[EVENTS] Failed to publish to Nostr: {e}")
+        # ERROR, not warning: this is the signer-outage shape of
+        # aiolabs/events#35 — the calendar event never reaches the relay
+        # and the published ticket counts stop tracking the DB.
+        logger.error(f"[EVENTS] Failed to publish event {event.id} to Nostr: {e}")
         return None